Overview
The idea is old — dice and word lists, decades before the web — and it survives because it solves a real tension. Symbol-soup passwords are strong but hostile to human memory, so people write them down or simplify them, which destroys the strength. A phrase of unrelated words flips the trade: each word you add multiplies the search space enormously while remaining something a brain can hold onto.
The catch, and it is non-negotiable, is that the words must be genuinely random. A lyric, a quote, or your street plus your dog's name is not a passphrase in this sense — attackers try exactly those shapes first. This tool draws from a list of about 150 plain, spellable English words using your browser's cryptographic random source, so every word is equally likely and none of them is about you.
Why do words work as passwords?
Because security comes from the size of the haystack, not from how messy the password looks. If each word is drawn fairly from a list of around 150, every word multiplies the possibilities by 150. Four words give hundreds of millions of combinations; six words push past what casual guessing can ever reach — and the phrase stays typable on a phone keyboard, a TV remote, or a laptop at 2 a.m.
Length helps twice here: each word adds entropy and also adds characters, and many systems reward sheer length. A five-word phrase from this list carries more entropy than most eight-character passwords people actually use, with the practical bonus that you will remember it instead of taping it under the keyboard.
Features
- Three to eight words, set by slider or number box to fit the rules of the site you are joining.
- Four separators — hyphen, underscore, space or dot — for systems that accept some characters and reject others.
- Optional capitalisation of every word, satisfying 'must contain uppercase' rules effortlessly.
- Optional trailing digit, drawn at random, for sites that demand a number.
- Live entropy estimate in bits with a plain strength label, recalculated on every change.
- Instant regeneration — touch any control and a fresh phrase appears; one click copies it.
- Cryptographic word selection with rejection sampling, so every word on the list is equally likely.
- Plain, spellable word list — no obscure vocabulary you will mistype on a small keyboard.
Benefits
- Memorable by construction. Familiar words stick after a few uses — ideal for secrets typed from memory.
- Easy to type and say. Words beat symbol strings on phones, remotes and phone calls.
- Private by architecture. The phrase is assembled in your browser; no server copy can ever leak.
- Strength you can see. The estimate is arithmetic — add a word, watch the number climb.
Who can use it
Anyone who needs a strong secret they will sometimes type by hand: the master password for a password manager, a disk-encryption passphrase, a Wi-Fi key read out to visitors. It also suits people who struggle with symbol-heavy passwords — a password people avoid using gets replaced by a weaker one. Teams can use it for shared credentials that must be spoken over a call without spelling every character.
How to use
- Start with four words for ordinary accounts; take five or six for a master password or anything guarding valuable data.
- Pick a separator the destination accepts — hyphens are the safest default; use spaces only where you are sure they are allowed.
- Leave capitalisation on if the site requires an uppercase letter; add the trailing digit if it requires one.
- Read the entropy estimate and aim for 'strong' or better on important accounts.
- Press Copy passphrase, paste it where it belongs, and store it in your manager. A different phrase for every account.
Frequently asked questions
Why words instead of random symbols?
Because of human memory. Symbol passwords get written down, simplified or reused — all of which destroy their strength. Word phrases keep their strength precisely because you can remember them, so you don't sabotage them. For secrets typed from memory, words are the pragmatic winner.
How many words do I actually need?
Four words is a respectable floor for ordinary accounts. Five to six is the sweet spot for anything important — a master password, email, backups. Each extra word multiplies the attacker's work enormously, so when in doubt, add one more word rather than fancier extras.
Can I just invent my own phrase?
That is exactly what not to do. Human-invented phrases follow grammar and habit — song lyrics, quotes, personal facts — and cracking tools model both. The security comes from the draw being random; your taste in words is the bias the tool exists to remove.
Which separator should I choose?
Hyphens are the safest default — accepted almost everywhere and easy to read. Underscores and dots work on most systems too. Spaces are the most readable but some sites reject them, so only choose spaces when you are sure the destination allows them.
Is a passphrase strong enough for my bank?
A five- or six-word phrase from this generator is stronger than the vast majority of passwords actually in use at banks. Pair it with two-factor authentication, never reuse it, and it is an excellent choice — far better than the short 'clever' password most people use.
Does this page record my passphrase?
No. The words are selected in your browser's memory and vanish when the tab closes. Nothing is sent over the network, written to storage, or shown to anyone else.
Conclusion
When a password has to live in your head, words beat symbols. Let the generator draw them fairly, take five or six for anything that matters, and you get a secret that is pleasant to type and tedious to attack.